WordPress and IIS security... The correct files and folder permissions on windows server 2003 SP2/ IIS (6)
I am really confused...
I've been googling the internetz for hours and my concluction is that there is not really much written "out there"
on the topic of WordPress and IIS security settings on folders and files and the only one I have found so far is this one:
Here are the folder perms used by IIS that'll allow WP to be accessible.
For the whole WP folder have Read & Execute, List Folder Contents,Read permissions assigned to IUSR, IIS_IUSRS, NETWORK SERVICE and to allow WP to automatically manage the files when downloading and installing new plugins/themes trough the WP dashboard then assignFull Control permissions for the "wp-content" folder to those listed users (not a good idea to leave it open all the time like this tho). If you have Zend Server installed for PHP content then you might also need to give the Read, Write, Execute permissions to ZendUser.
http://wordpress.org/support/topic/windows-iis-permissions?replies=5
Plus I have found this one: http://koderguru.com/tutorials/phptutorials/permissiondenyiis.php
I have tried the first one, but not with success as installation could not find/see the WP-config.php files plus functionality as upgrade/install plugins and upgrade WordPress itself do not work then. Also uploads of pictures do not work with those settings. However if you assign FULL permissions to the IUSR and NETWORK SERVICE (not recommended of course) - everything works fine.
So my question is very simple:
- What is the correct files and folder permissions for windows 2003 server running IIS6 to get WordPress running smoothly?
- What permission on which files and folders - WordPress recommends chmod files to 644 and folders to 755. ( http://wordpress.org/support/topic/wordpress-file-permissions?replies=6 ) but if I understand this right, using a ftp client to change the files and folder permissions through ftp does not work on windows as Microsoft does not use the "chmod" feature as it is a linux feature? So the only option you have is to change it manually through the properties security tab directly on the windows server machine's folders and files?
- What built in user account should be used?
- If I'm wrong and you can edit the files though a ftp server - what permissions do you use - clearly the wordpress.org recommendations are for Linux/apache? - what is the correct settings for windows if applicable?
It would be very nice to finally sort this conundrum out so I can have a safe and secure installation running on my windows server box.
Thank you so much in advance for contributing to sort this to me very important issue out!
Oh! Just one final note: It is not possible for me to move to windows 2008 server for the moment, I'm stucked with 2003 server until further notice. Thank you for your understanding on that part.
Sincerely
Daniel